feat: Initial clean release of CHM

packages/renderer/MdToHtml/rules/sanitize_html.ts

@@ -0,0 +1,59 @@
+import { RuleOptions } from '../../MdToHtml';
+import htmlUtils from '../../htmlUtils';
+import type * as MarkdownIt from 'markdown-it';
+import type Token = require('markdown-it/lib/token');
+import type StateCore = require('markdown-it/lib/rules_core/state_core');
+
+const md5 = require('md5');
+
+export default {
+	plugin: function(markdownIt: MarkdownIt, ruleOptions: RuleOptions) {
+		markdownIt.core.ruler.push('sanitize_html', (state: StateCore) => {
+			const tokens = state.tokens;
+
+			const walkHtmlTokens = (tokens: Token[]) => {
+				if (!tokens || !tokens.length) return;
+
+				for (const token of tokens) {
+					if (!['html_block', 'html_inline'].includes(token.type)) {
+						walkHtmlTokens(token.children);
+						continue;
+					}
+
+					const cacheKey = md5(escape(token.content));
+					let sanitizedContent = ruleOptions.context.cache.value(cacheKey);
+
+					// For html_inline, the content is only a fragment of HTML, as it will be rendered, but
+					// it's not necessarily valid HTML. For example this HTML:
+					//
+					// <a href="#">Testing</a>
+					//
+					// will be rendered as three tokens:
+					//
+					// html_inline: <a href="#">
+					// text: Testing
+					// html_inline: </a>
+					//
+					// So the sanitizeHtml function must handle this kind of non-valid HTML.
+
+					if (!sanitizedContent) {
+						sanitizedContent = htmlUtils.sanitizeHtml(
+							token.content,
+							{
+								addNoMdConvClass: true,
+								allowedFilePrefixes: ruleOptions.allowedFilePrefixes,
+							},
+						);
+					}
+
+					token.content = sanitizedContent;
+
+					ruleOptions.context.cache.setValue(cacheKey, sanitizedContent, 1000 * 60 * 60);
+					walkHtmlTokens(token.children);
+				}
+			};
+
+			walkHtmlTokens(tokens);
+		});
+	},
+};